IT - Links

Information Security

Information Gathering

• CVE Details
• Exploit Database
• IPv4info
• Linux Distribution Packages Database
• Shodan
• Snyk Vulnerability DB

Pentesting

• Payloads All The Things (github collection)
• SecLists wordlists (github collection)
• Unicode confusables

Mobile Pentesting

• awesome-mobile-security (github collection)
• objection
• objection tutorial

Android Pentesting

• Android Permissions

iOS Pentesting

• iOS Security 101 (slides)
• iOS Pentesting - Introduction
• ATS - NSAppTransportSecurity
• lldb for iOS
• gdb and lldb command examples

Linux Security

• Linux Hardening in the Wild
• Fixing the Desktop Linux Security Model

Windows Security

• Kerberosity Killed the Domain: An Offensive Kerberos Overview

Web Pentesting

• MDN - Cross-Origin Resource Sharing
• Stanford CS 253 Web Security
• CSP Evaluator
• Better API Penetration Testing with Postman
• How to Find XXE Bugs

Post Exploitation

• THC’s favourite Tips, Tricks & Hacks

Hardware Security

• NSA ANT catalog
• TPM Genie
• INCEPTION (DMA attack)
• PCILeech (DMA attack)

BIOS/UEFI/Boot Security

• Defeating a Laptop’s BIOS Password

Guides

• OWASP Firmware Security Testing Methodology
• OWASP Mobile Security Testing Guide
• HackTricks
  • Awesome guide for pentesting web, linux, windows, mobile, etc.

Crypto

• Going Bark: A Furry’s Guide to End-to-End Encryption
• Latacora - The PGP Problem

Attestation

• Binary Transparency
• Key Transparency

General IT

Web

• A re-introduction to JavaScript (JS tutorial)

Debian

• Removal of jessie-updates and jessie-backports from debian mirrors
  • this article has a nice graph of how packages go through the different repositories (security, stable-updates, …)

Memorable Articles and Stuff

• ASCIIMATION Star Wars via telnet
• Super Mario World Credits Warp Explained
• Taking Back What Is Already Yours: Router Wars Episode I

Server Configuration

• SSH login alert with sendmail and PAM

Useful Tools

• RegExr: Learn, Build & Test RegEx